SpyAxe - it's wicked!

**Curio** · December 20th, 2005, 19:58 PM

Seeing quite a bit of SpyAxe dodgy adware infestation at the moment and it can be a bit of a git for the uninitiated. Why? It doesn't run as a program and there are no traceable startup entries but it's there all the time. Seems to inject itself into Explorer so you can't terminate it and it can do naughty things without you being able to stop it. My generic fix at the moment is to open %systemroot%\system32\ and look for dll files listing them by date modified - the last one (most recent) is likely to be the offending dll so you must rename or delete it. Try renaming it (so far had svchosts.dll and ioctrl.dll) and if you can't rename it then it probably is the right one - use killbox to delete on reboot, you already know how to do that.
Some sites I have seen tell you to run the uninstaller in %programfilesdir%\spyaxe\ - don't waste your time it just deletes the program files but the dll remains loaded in Explorer and continues to nag you like a woma... well lets say it continues to nag you a lot.
Usually has associated other spyware adware like SmitFraud and searchexe but they are easy enough to remove so I won't bore you with the details.

**FastGame** · December 21st, 2005, 01:19 AM

Did you get a SpyAxe sample or actually caught it on the net ?

You can get a nice removal tool and instructions Here

**Curio** · December 21st, 2005, 08:58 AM

I don't have it thanks - I have been removing it from peoples computers, the tool you refer to runs the spyaxe uninstaller which does not remove the spyaxe nagger. SpyAxe the program does get removed but the naggy bit isn't, or I should say it wasn't when I tried it a few days ago - perhaps they have updated the tool since then.
I have looked into it a bit more and the nagger appears to be started via a scheduled task - there is now a good technical description on 2-spyware which I believe is something to do with pc-tools. MWAV also now (as of 20th Dec) removes the little bits of SpyAxe so it doesn't re-appear when you reboot.
It's still nice to do it manually though - so you are ready for the next variant plus at the time there were no working removal tools or guides on the net.

Merry Xmas

Aloone_Jonez · December 25th, 2005, 14:50 PM

Have you checked the registry and services.msc?

December 20th, 2005, 19:58 PM	#1
Curio Triple Platinum Member Join Date: Nov 2004 Location: London Posts: 907	SpyAxe - it's wicked! Seeing quite a bit of SpyAxe dodgy adware infestation at the moment and it can be a bit of a git for the uninitiated. Why? It doesn't run as a program and there are no traceable startup entries but it's there all the time. Seems to inject itself into Explorer so you can't terminate it and it can do naughty things without you being able to stop it. My generic fix at the moment is to open %systemroot%\system32\ and look for dll files listing them by date modified - the last one (most recent) is likely to be the offending dll so you must rename or delete it. Try renaming it (so far had svchosts.dll and ioctrl.dll) and if you can't rename it then it probably is the right one - use killbox to delete on reboot, you already know how to do that. Some sites I have seen tell you to run the uninstaller in %programfilesdir%\spyaxe\ - don't waste your time it just deletes the program files but the dll remains loaded in Explorer and continues to nag you like a woma... well lets say it continues to nag you a lot. Usually has associated other spyware adware like SmitFraud and searchexe but they are easy enough to remove so I won't bore you with the details. __________________ I'm using Windows 7 - you got a problem with that? Last edited by Curio; December 20th, 2005 at 20:06 PM.

December 21st, 2005, 01:19 AM	#2
FastGame Hardware guy Super Moderator Join Date: Apr 2002 Location: Blasters worm farm Posts: 3,674	Did you get a SpyAxe sample or actually caught it on the net ? You can get a nice removal tool and instructions Here Last edited by FastGame; December 21st, 2005 at 01:29 AM.

December 21st, 2005, 08:58 AM	#3
Curio Triple Platinum Member Join Date: Nov 2004 Location: London Posts: 907	I don't have it thanks - I have been removing it from peoples computers, the tool you refer to runs the spyaxe uninstaller which does not remove the spyaxe nagger. SpyAxe the program does get removed but the naggy bit isn't, or I should say it wasn't when I tried it a few days ago - perhaps they have updated the tool since then. I have looked into it a bit more and the nagger appears to be started via a scheduled task - there is now a good technical description on 2-spyware which I believe is something to do with pc-tools. MWAV also now (as of 20th Dec) removes the little bits of SpyAxe so it doesn't re-appear when you reboot. It's still nice to do it manually though - so you are ready for the next variant plus at the time there were no working removal tools or guides on the net. Merry Xmas __________________ I'm using Windows 7 - you got a problem with that? Last edited by Curio; December 21st, 2005 at 09:01 AM.

Thread Tools
Show Printable Version Email this Page
Display Modes
Linear Mode Switch to Hybrid Mode Switch to Threaded Mode

December 25th, 2005, 14:50 PM	#4
Aloone_Jonez Banned Join Date: Dec 2005 Posts: 60	Have you checked the registry and services.msc?